Overview

overview

10

Static

static

User Help ...es.exe

windows7_x64

10

User Help ...es.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    User Help Services.exe

  • Size

    3.6MB

  • Sample

    210105-rhryqwvmls

  • MD5

    8333ca39ae364a0c977dc6d304495a05

  • SHA1

    fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de

  • SHA256

    d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

  • SHA512

    e010f5130262a96bcf1f779ca3a708070adc99802eb9d278e6300eaa7b950019595019e1bd974401de4e75d130a990501be06f31066471e7e2e0af2f4f63cc2e

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

95.154.196.12:5851

Targets

    • Target

      User Help Services.exe

    • Size

      3.6MB

    • MD5

      8333ca39ae364a0c977dc6d304495a05

    • SHA1

      fb0fb6f73019f645aaaa6b7ffd40c2d9df39e5de

    • SHA256

      d0fbaa4e5d7b512cdc4b3b63ddbed59d1cb741f3925381124ee91942ecfdf3a6

    • SHA512

      e010f5130262a96bcf1f779ca3a708070adc99802eb9d278e6300eaa7b950019595019e1bd974401de4e75d130a990501be06f31066471e7e2e0af2f4f63cc2e

    Score
    10/10
    remcosrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks